So-called triple modular reduncance (TMR) is described, e.g., by Michael Ball and Fred Hardie, IBM Corp. Owego, N.Y., in the journal "Computer design" January 1969, pp 50-52. With the aid of the triple hardware redundance there is obtained a modular system, the reliability and fault tolerance of which is greater in certain respects than in a dual redundancy system, which solely includes an executive module, e.g., an executive processor, and a reserve module, e.g., a reserve processor. A dual processor system operating parallelsynchronously is described, e.g., in the U.S. Pat. No. 4 099 241.
As is known, the disadvantages of the dual systems reside in that, due to a comparison between data or control signals produced parallel-synchronously by the executive processor and the reserve processor, it can only be discovered that a fault is present, but, without carrying out time-consuming test programs, there is no possibility of indicating which is the faulty processor. On the other hand, the above-mentioned TMR systems include fault localizing means for indicating one of the three cooperating identical modules if it transmits faulty control signals. In the journal "Electronics", Jan. 27, 1983, pp 98-102, there is described a real time system including three identical control computers, wherein real time signals are distributed to all the computers, and a majority selection is carried out between the control signals, which are generated parallel-synchronously by the previously mutually updated computers. The synchronization of the above mentioned known TMR system relates to the timing in which the modules/computers receive the real time signals and transmit the control signals. The known fault localizing/majority selection means receive real time/control signals and therefore contain rather complicated circuits, e. g. masking circuits, which per se constitute fault sources.